Do not append input value of AS comparison if the check is eliminated. Fixes issue 4944, crash caus…

runtime/vm/flow_graph_builder.cc

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/flow_graph_builder.h"
 
 #include "vm/ast_printer.h"
 #include "vm/code_descriptors.h"
 #include "vm/dart_entry.h"
 #include "vm/flags.h"
@@ skipping 675 matching lines @@
 }
 
 
 void EffectGraphVisitor::BuildTypeCast(ComparisonNode* node) {
   InlineBailout("EffectGraphVisitor::BuildTypeCast");
   ASSERT(Token::IsTypeCastOperator(node->kind()));
   const AbstractType& type = node->right()->AsTypeNode()->type();
   ASSERT(type.IsFinalized());  // The type in a type cast may be malformed.
   ValueGraphVisitor for_value(owner(), temp_index());
   node->left()->Visit(&for_value);
-  Append(for_value);
   const String& dst_name = String::ZoneHandle(
       Symbols::New(Exceptions::kCastExceptionDstName));
   if (!CanSkipTypeCheck(node->token_pos(), for_value.value(), type, dst_name)) {
+    Append(for_value);
     Do(BuildAssertAssignable(
         node->token_pos(), for_value.value(), type, dst_name));
   }
 }
 
 
 void ValueGraphVisitor::BuildTypeTest(ComparisonNode* node) {
   InlineBailout("ValueGraphVisitor::BuildTypeTest");
   ASSERT(Token::IsTypeTestOperator(node->kind()));
   const Bool& bool_true = Bool::ZoneHandle(Bool::True());
@@ skipping 1830 matching lines @@
   intptr_t len = OS::SNPrint(NULL, 0, kFormat, function_name, reason) + 1;
   char* chars = Isolate::Current()->current_zone()->Alloc<char>(len);
   OS::SNPrint(chars, len, kFormat, function_name, reason);
   const Error& error = Error::Handle(
       LanguageError::New(String::Handle(String::New(chars))));
   Isolate::Current()->long_jump_base()->Jump(1, error);
 }
 
 
 }  // namespace dart